Two healthcare data breaches reported in mid-2026 highlight ongoing control failures in the sector. All About Women's Care in Colorado revealed an unauthorized actor accessed an employee VPN account, compromising data for 12,000 patients. Meanwhile, Mid-South Pulmonary Sleep Specialists in Tennessee is assessing the impact of a November 2025 ransomware attack by the Anubis group. Both incidents underscore preventable failures in remote access security and third-party risk management.
What the Data Shows
The All About Women's Care breach began with a compromised employee VPN credential. The unauthorized actor accessed the network and copied files containing sensitive information, including names, Social Security numbers, clinical data, and health insurance details. The investigation took several months, concluding on June 5, 2026.
At Mid-South Pulmonary Sleep Specialists, suspicious activity was detected on November 2, 2025. The Anubis group added the practice to its data leak site later that month, claiming to have stolen patient data. The data review concluded on May 18, 2026, revealing exposure of personal and medical information.
Both incidents were reported to the HHS Office for Civil Rights, as required under the Health Information Technology for Economic and Clinical Health Act's breach notification provisions.
Key Findings
VPN credentials remain a critical attack vector. The All About Women's Care breach shows that a single set of employee VPN credentials can provide full network access. This isn't a sophisticated attack; it's credential theft followed by authorized-looking access. Your perimeter defenses won't stop it because the actor is using valid credentials.
Detection-to-containment timelines are too long. Mid-South Pulmonary Sleep Specialists detected suspicious activity on November 2, 2025, but the data review wasn't complete until May 18, 2026. That's a six-month gap between detection and understanding what was compromised. During that window, you're operating blind on notification obligations and can't provide patients with specific guidance on what to monitor.
Ransomware groups are publishing healthcare data. Anubis didn't just encrypt systems at Mid-South Pulmonary Sleep Specialists. They exfiltrated data and posted samples publicly when ransom demands weren't met. This dual-extortion model means your incident response can't focus solely on system restoration. You're also managing a data exposure event with all the notification and regulatory implications that entails.
Third-party forensic support is standard, but slow. Both practices engaged external cybersecurity experts. That's the right move for HIPAA Security Rule § 164.308(a)(1)(ii)(D) evaluation and response requirements. But if your first time working with a forensic firm is during an active breach, expect delays while they onboard, scope the engagement, and build familiarity with your environment.
What This Means for Your Team
You're likely running VPNs for clinicians, billing staff, and administrative employees who need remote access. Every one of those accounts is a potential entry point. If you're relying on username and password alone, you're one phishing email away from the same scenario All About Women's Care faced.
Your current detection capabilities probably can't distinguish between legitimate remote access and credential misuse. An unauthorized actor using valid VPN credentials looks identical to an employee working from home. Without additional behavioral analytics or session monitoring, you won't know until files start moving in unusual patterns.
The HIPAA Security Rule requires you to implement procedures to detect security incidents and mitigate their harmful effects (§ 164.308(a)(6)(i) and (ii)). But detection alone isn't sufficient. You need the forensic capability to determine what was accessed, when, and by whom. If you're building that capability during an incident, you're adding months to your notification timeline.
Action Items by Priority
Implement multi-factor authentication on all VPN access immediately. This is NIST SP 800-53 control IA-2(1) and addresses the exact failure mode in the All About Women's Care breach. Require a second factor (authenticator app, hardware token, or push notification) for every VPN session. Yes, this will generate helpdesk tickets. That's better than a breach notification to 12,000 patients.
Deploy session monitoring for remote access accounts. You need visibility into what happens after authentication. Monitor for unusual file access patterns, bulk downloads, access to systems outside normal job functions, and connections from unexpected geographic locations. SIEM tools can baseline normal behavior and alert on deviations. This is your early warning system for credential misuse.
Pre-negotiate forensic response agreements. Don't wait until you're in the middle of an incident to engage cybersecurity experts. Establish relationships with forensic firms now, negotiate rates, and document escalation procedures. Include provisions for immediate response availability. The difference between a three-day and three-week engagement start can determine whether you meet the 60-day breach notification deadline under HIPAA.
Test your backup restoration process for ransomware scenarios. Mid-South Pulmonary Sleep Specialists faced both encryption and data exfiltration. Your backups solve the first problem, but only if you can restore systems quickly. Test restoration under the assumption that your primary environment is compromised and you need to rebuild in an isolated segment. Document how long full restoration takes. If it's longer than your organization can tolerate, that's a risk acceptance decision that should be documented and approved by leadership.
Review VPN account provisioning and deprovisioning. The compromised account at All About Women's Care belonged to an employee. Was that person still employed? Did they need VPN access for their current role? Audit your VPN user list against your current employee roster and apply Role-Based Access Control principles. Remove accounts for terminated employees within 24 hours. Disable accounts for employees on extended leave.
Implement Just-in-Time Access for privileged operations. If certain VPN accounts need elevated privileges for system administration, don't grant those privileges permanently. Require users to request temporary elevation for specific tasks, with approval workflows and automatic expiration. This limits the damage from a compromised account.
